MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2afb072fe81c319cbe4cee6d2c660a16a833b4243c8e5ea0aa041b2b974c3ef5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2afb072fe81c319cbe4cee6d2c660a16a833b4243c8e5ea0aa041b2b974c3ef5
SHA3-384 hash: d17d3399fef7158548869a63111fbf4d047f5c946a7639b305ffb62350d88e0211b6de5fb0f9142c728ff7612521960c
SHA1 hash: 6e39848c5c15c2b368e3035ef569b467422daa38
MD5 hash: fb289ddce847c3a0a929ea37a749c7b2
humanhash: nuts-coffee-five-missouri
File name:E-dekont_pdf.exe
Download: download sample
Signature Formbook
Create hunting rule
File size:157'507 bytes
First seen:2023-05-24 07:12:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 59a4a44a250c4cf4f2d9de2b3fe5d95f (70 x GuLoader, 13 x AgentTesla, 7 x AZORult)
ssdeep 3072:1DQkrZoosbIfXJ/ppJCMpPR91lgacsd/7gAqja1ljBin7ZK8ukA+xDQ3y6+UVe6t:1DpoeJFpP5lgI/PQa1ljBin7Eh4Ds+U5
Threatray 1'595 similar samples on MalwareBazaar
TLSH T1A6F3025222C684B3E9934A710473D7B6E27BEA306A1D4F5B3F416F662D3210BCD2D1D1
TrID 92.7% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133)
3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
1.1% (.EXE) Win64 Executable (generic) (10523/12/4)
0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon e0a8e0c8e0a0a2ca (5 x GuLoader, 3 x Formbook)
Reporter abuse_ch
Tags:exe FormBook geo TUR

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
E-dekont_pdf.exe
Verdict:
Suspicious activity
Analysis date:
2023-05-24 07:14:56 UTC
Tags:
installer
Link:
https://app.any.run/tasks/1e002e9f-9f05-4f86-b4f3-e98c2f4371e4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/390989/
Detection(s):
SecuriteInfo.com.ADWARE.Adware.Gen.171.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a file in the %AppData% subdirectories
Delayed reading of the file
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/646db8feb1626163b518d450/reports/a1373754-a095-457a-a87a-48a4af841c45/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2afb072fe81c319cbe4cee6d2c660a16a833b4243c8e5ea0aa041b2b974c3ef5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/03b1f3ea-4045-434a-89f9-3f1a088f8681
Result
Threat name:
FormBook
Create hunting rule
Detection:
malicious
Classification:
evad.troj
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1241476
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Found malware configuration
Initial sample is a PE file and has a suspicious name
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected FormBook
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 874487 Sample: E-dekont_pdf.exe Startdate: 24/05/2023 Architecture: WINDOWS Score: 100 33 www.shutterpilot.co.uk 2->33 35 www.monsterdonut.net 2->35 37 17 other IPs or domains 2->37 47 Snort IDS alert for network traffic 2->47 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 7 other signatures 2->53 11 E-dekont_pdf.exe 35 2->11         started        signatures3 process4 file5 31 C:\Users\user\AppData\Local\...\System.dll, PE32 11->31 dropped 14 E-dekont_pdf.exe 6 11->14         started        process6 dnsIp7 45 34.138.169.8, 49811, 80 ATGS-MMD-ASUS United States 14->45 61 Modifies the context of a thread in another process (thread injection) 14->61 63 Tries to detect Any.run 14->63 65 Maps a DLL or memory area into another process 14->65 67 2 other signatures 14->67 18 explorer.exe 4 1 14->18 injected signatures8 process9 dnsIp10 39 ghazihaqim.com 116.89.76.8, 49858, 80 STARHUB-NGNBNStarhubLtdSG Singapore 18->39 41 www.digiunlock.com 199.233.239.232, 49830, 80 QUICKPACKETUS United States 18->41 43 10 other IPs or domains 18->43 55 System process connects to network (likely due to code injection or exploit) 18->55 22 rundll32.exe 18->22         started        25 autochk.exe 18->25         started        signatures11 process12 signatures13 57 Modifies the context of a thread in another process (thread injection) 22->57 59 Maps a DLL or memory area into another process 22->59 27 cmd.exe 1 22->27         started        process14 process15 29 conhost.exe 27->29         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2afb072fe81c319cbe4cee6d2c660a16a833b4243c8e5ea0aa041b2b974c3ef5/
Threat name:
Win32.Trojan.Guloader
Create hunting rule
Status:
Malicious
First seen:
2023-05-22 11:30:30 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fl5qol7idqyzzpsm5zwsyzqkc2udhnbehshf5ifkaqnsxf2mh32q._file
Verdict:
malicious
Label(s):
formbook
Create hunting rule
Similar samples:
28384833cb4f57932b5344a38245cc995941d7fcccc387a2ffa7f295c91108ac
Formbook
31d4fa7c04a77660000eeecf8f66e38d6108f460ea7b539744d7bf9216266a50
Formbook
856c3482c119fdecb777d14ef351c90a24a045cf8da8cafbb2d229619cb11bbf
Formbook
a10c47f496d40583af7bfb8b2fd41014e9f37a527ed72df784a874fceaf558a4
Formbook
a1a882d7abefdec8678649330339a2f080a777450da1be5110b88e81a8ea38cc
Formbook
a9c993b79501ed32742c5ccfd04e3c47d75fd26795fd87bb3dfc288384de7be3
Formbook
b97d675cc03e2f033970f5357f256e461792111b78d27944225ba91558ca14cc
Formbook
cd24796ce83ec93f4e5e116d5402986cca52840cf878f7cdedc63f865734d409
Formbook
d167c08baf19919551b1731763974baa43a7193cfaf4704d754308d53bdb2b5e
Formbook
e29c4da2ffb29da2ca94953e638058674b6234ac0c75864d644a661d582a3ab1
Formbook
+ 1'585 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230524-h13crabc45/
Behaviour
Enumerates physical storage devices
Loads dropped DLL
Unpacked files
SH256 hash:
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 hash:
a436db0c473a087eb61ff5c53c34ba27
SHA1 hash:
65ea67e424e75f5065132b539c8b2eda88aa0506
Link:
https://www.unpac.me/results/9f556017-3ac7-4510-971c-a3794c56cd3c/
SH256 hash:
2afb072fe81c319cbe4cee6d2c660a16a833b4243c8e5ea0aa041b2b974c3ef5
MD5 hash:
fb289ddce847c3a0a929ea37a749c7b2
SHA1 hash:
6e39848c5c15c2b368e3035ef569b467422daa38
Link:
https://www.unpac.me/results/9f556017-3ac7-4510-971c-a3794c56cd3c/
Malware family:
FormBook
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2afb072fe81c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.08
Link:
https://yomi.yoroi.company/submissions/2afb072fe81c319cbe4cee6d2c660a16a833b4243c8e5ea0aa041b2b974c3ef5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/390989/

Comments